Consent

What is Consent for Data Processing?

Consent for data processing refers to the process by which an organization obtains direct permission from an individual before processing their personal data. Under the General Data Protection Regulation (GDPR), consent is one of six lawful bases for processing personal data, and there are many situations in which an alternative basis (such as legitimate interest or contractual necessity) will be more appropriate. In instances when consent is necessary or beneficial, it is important to understand what constitutes valid consent under Article 4(11) and Article 7 of the GDPR. As described by the Information Commissioner's Office (ICO), consent "means offering individuals real choice and control; genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation."

For many individuals, the assurance of privacy and security is crucial when it comes to the management of their personal information, and obtaining consent can be a reliable way to offer full transparency and control over how their data is used. However, an organization should rely on an alternative lawful basis for processing if it cannot genuinely offer the individual a choice, or if it would otherwise process the data regardless of the individual's response.

How Do You Obtain User Consent?

If consent is the most appropriate basis for processing, an organization must meet strict criteria under the GDPR for it to be considered valid. Under Article 4(11), consent must be freely given, specific, informed, and unambiguous. It must be indicated through a clear affirmative action, such as ticking an opt-in box, clicking a button, or signing a declaration. Pre-ticked boxes, silence, or inactivity do not constitute valid consent. Consent requests must also remain separate from standard terms and conditions and be presented in a manner that is "clearly distinguishable from other matters," using clear and plain language (Article 7(2)). In cases where explicit consent is required, such as the processing of special categories of personal data (racial or ethnic origin, health data, biometric data, etc.), consent must be affirmed through a clear oral or written statement, not merely through a general affirmative action.

What is Consent Management?

Valid consent does not end at the point of collection. All records of consent must be documented and accessible, as Article 7(1) requires controllers to be able to demonstrate that the data subject consented to processing. Because the GDPR emphasizes the individual's ongoing ability to choose what happens to their data, an organization must allow consent to be withdrawn at any time, and withdrawal must be as easy as giving consent (Article 7(3)). An organization may not switch to a different legal basis for processing after consent has been withdrawn. Similarly, making consent a precondition of a service is not considered freely given if the processing is not necessary for the performance of that contract (Article 7(4), Recital 43).